{"cves":["CVE-2026-11856","CVE-2026-8458","CVE-2026-8924","CVE-2026-8927","CVE-2026-8932"],"cvss":0.0,"database_specific":{"severity":"IMPORTANT"},"description":"[7.61.1-34.el8_10.18]\n- fix incomplete mTLS config in connection reuse (CVE-2026-8932)\n\n[7.61.1-34.el8_10.17]\n- fix cookie injection via trailing dot super cookies (CVE-2026-8924)\n- fix digest auth state leak on origin or credential change (CVE-2026-11856)\n\n[7.61.1-34.el8_10.16]\n- add sasl service name to connection reuse checks (CVE-2026-8458)\n\n[7.61.1-34.el8_10.15]\n- detect proxy changes read from environment (CVE-2026-8927)\n\n[7.61.1-34.el8_10.14]\n- h2: allow 100 streams by default (RHEL-232829)\n- tests: disable 1701 (h2c POST Upgrade vs nghttpx CVE-2026-58055)","id":"ELSA-2026-92368","ovalId":"oval:com.oracle.elsa:def:202692368","source":"oracle_linux","title":"ELSA-2026-92368:  curl security, bug fix, and enhancement update (IMPORTANT)","url":"https://linux.oracle.com/errata/ELSA-2026-92368.html"}